Skip to content

netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP

Phil Sutter requested to merge psutter1/centos-stream-9:c9s/RHEL-5434 into main

JIRA: https://issues.redhat.com/browse/RHEL-5434 Upstream Status: commit 7433b6d2afd512d04398c73aa984d1e285be125b CVE: CVE-2023-42756

commit 7433b6d2afd512d04398c73aa984d1e285be125b Author: Jozsef Kadlecsik kadlec@netfilter.org Date: Tue Sep 19 20:04:45 2023 +0200

netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP

Kyle Zeng reported that there is a race between IPSET_CMD_ADD and IPSET_CMD_SWAP
in netfilter/ip_set, which can lead to the invocation of `__ip_set_put` on a
wrong `set`, triggering the `BUG_ON(set->ref == 0);` check in it.

The race is caused by using the wrong reference counter, i.e. the ref counter instead
of ref_netlink.

Fixes: 24e227896bbf ("netfilter: ipset: Add schedule point in call_ad().")
Reported-by: Kyle Zeng <zengyhkyle@gmail.com>
Closes: https://lore.kernel.org/netfilter-devel/ZPZqetxOmH+w%2Fmyc@westworld/#r
Tested-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>

Signed-off-by: Phil Sutter psutter@redhat.com

Merge request reports